{
  "type": "URL",
  "indicator": "https://ro03.younglok.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ro03.younglok.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4086507807,
      "indicator": "https://ro03.younglok.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "687d30048b95aaba628a5ee7",
          "name": "Working on it\u2026\u2026",
          "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
          "modified": "2025-08-19T17:00:59.379000",
          "created": "2025-07-20T18:05:56.587000",
          "tags": [
            "dynamicloader",
            "united",
            "as15169",
            "medium",
            "search",
            "show",
            "write c",
            "whitelisted",
            "brazil as396982",
            "high",
            "themida",
            "write",
            "delphi",
            "copy",
            "upatre",
            "encrypt",
            "june",
            "win32",
            "malware",
            "win64",
            "windows nt",
            "directui",
            "element",
            "classinfobase",
            "value",
            "hwndhost",
            "sapeav12",
            "delete c",
            "worm",
            "explorer",
            "insert",
            "movie",
            "alerts",
            "windows",
            "installs",
            "filehash",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "passive dns",
            "urls",
            "http",
            "ip address",
            "related nids",
            "files location",
            "spain flag",
            "spain domain",
            "files related",
            "spain",
            "entries",
            "next associated",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "gmt content",
            "filehashsha256",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "filehashmd5",
            "showing",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "iocs",
            "learn more",
            "filehashsha1",
            "types of",
            "united kingdom",
            "t1053",
            "taskjob",
            "t1055",
            "injection",
            "t1082",
            "t1119",
            "t1129",
            "modules",
            "t1143",
            "soundcloud",
            "created",
            "hour ago",
            "facebook",
            "twitter",
            "victims website",
            "youtube",
            "jansky",
            "trojandropper",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2012,
            "FileHash-MD5": 140,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1348,
            "SSLCertFingerprint": 3,
            "domain": 288,
            "hostname": 812
          },
          "indicator_count": 4732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "686e17b1ac7253ec7e12f1e8",
          "name": "FT Adviser | Foundry - platform.twitter.com + Apple + T-Mobile",
          "description": "FT Adviser | Foundry - platform.twitter.com + Apple + T-Mobile | ImFurther investigation of familiar IoC\u2019s  in Tethering T-mobile to iOS research. \n\nPalantir is the the Cyber Defense Firm that provides the weapons, man force, military, false arrest records ,reputation damage, the man who drove her off the road, constant stalking and the marketing of her music in other media.\n Realize this hot stock you\u2019re investing is a domestic and international terrorist organization.  There are several\nPeople here being 24/7/365 monitored.\nThey have fulfillment centers from Amazon and can provide food to medicine, they have the entire military, all\ngovernment contracts and their own physicians. \n\n#malware #foundry #rip #palantir # twitter #paypalmafia  #quasi #government # workerscompensation #law_enforcement # #jeffreyreimer #sabey #tsarabrashearslivesinourhearts",
          "modified": "2025-08-08T06:00:40.325000",
          "created": "2025-07-09T07:18:09.062000",
          "tags": [
            "present jun",
            "united",
            "status",
            "present may",
            "present sep",
            "search",
            "date",
            "entries",
            "trojan",
            "name servers",
            "ransom",
            "twitter",
            "redacted for",
            "showing",
            "passive dns",
            "urls",
            "softlayer",
            "internet",
            "encrypt",
            "record value",
            "body",
            "service",
            "russia",
            "spain",
            "germany",
            "netherlands",
            "aaaa",
            "france",
            "virtool",
            "creation date",
            "expiration date",
            "servers",
            "hostname add",
            "pulse pulses",
            "files",
            "present aug",
            "ip address",
            "applenoc",
            "unknown ns",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "unknown aaaa",
            "secure server",
            "msie",
            "chrome",
            "moved",
            "title",
            "gmt content",
            "type",
            "pulse submit",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses otx",
            "pulses",
            "related tags",
            "google safe",
            "indicator role",
            "title added",
            "active related",
            "url https",
            "dynamicloader",
            "write c",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "html",
            "as15169",
            "write",
            "xport",
            "copy",
            "guard",
            "malware",
            "suspicious",
            "next",
            "extraction",
            "data upload",
            "failed",
            "extri data",
            "include review",
            "exclude",
            "sugges",
            "stop x",
            "s data",
            "extr data",
            "extraction data",
            "enter soudcetdi",
            "ad tevdag",
            "cadad ad",
            "draie",
            "extri include",
            "review",
            "done",
            "levelblue",
            "exclude sugges",
            "uny inuuue",
            "find s",
            "typ hos",
            "script urls",
            "canada unknown",
            "script domains",
            "a domains"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 181,
            "FileHash-SHA1": 154,
            "FileHash-SHA256": 1857,
            "domain": 1424,
            "email": 13,
            "hostname": 1304,
            "URL": 4168,
            "CVE": 1,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9106,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "255 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 13797
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/younglok.com",
    "whois": "http://whois.domaintools.com/younglok.com",
    "domain": "younglok.com",
    "hostname": "ro03.younglok.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "687d30048b95aaba628a5ee7",
      "name": "Working on it\u2026\u2026",
      "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
      "modified": "2025-08-19T17:00:59.379000",
      "created": "2025-07-20T18:05:56.587000",
      "tags": [
        "dynamicloader",
        "united",
        "as15169",
        "medium",
        "search",
        "show",
        "write c",
        "whitelisted",
        "brazil as396982",
        "high",
        "themida",
        "write",
        "delphi",
        "copy",
        "upatre",
        "encrypt",
        "june",
        "win32",
        "malware",
        "win64",
        "windows nt",
        "directui",
        "element",
        "classinfobase",
        "value",
        "hwndhost",
        "sapeav12",
        "delete c",
        "worm",
        "explorer",
        "insert",
        "movie",
        "alerts",
        "windows",
        "installs",
        "filehash",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "passive dns",
        "urls",
        "http",
        "ip address",
        "related nids",
        "files location",
        "spain flag",
        "spain domain",
        "files related",
        "spain",
        "entries",
        "next associated",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "gmt content",
        "filehashsha256",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "filehashmd5",
        "showing",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "iocs",
        "learn more",
        "filehashsha1",
        "types of",
        "united kingdom",
        "t1053",
        "taskjob",
        "t1055",
        "injection",
        "t1082",
        "t1119",
        "t1129",
        "modules",
        "t1143",
        "soundcloud",
        "created",
        "hour ago",
        "facebook",
        "twitter",
        "victims website",
        "youtube",
        "jansky",
        "trojandropper",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2012,
        "FileHash-MD5": 140,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1348,
        "SSLCertFingerprint": 3,
        "domain": 288,
        "hostname": 812
      },
      "indicator_count": 4732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "686e17b1ac7253ec7e12f1e8",
      "name": "FT Adviser | Foundry - platform.twitter.com + Apple + T-Mobile",
      "description": "FT Adviser | Foundry - platform.twitter.com + Apple + T-Mobile | ImFurther investigation of familiar IoC\u2019s  in Tethering T-mobile to iOS research. \n\nPalantir is the the Cyber Defense Firm that provides the weapons, man force, military, false arrest records ,reputation damage, the man who drove her off the road, constant stalking and the marketing of her music in other media.\n Realize this hot stock you\u2019re investing is a domestic and international terrorist organization.  There are several\nPeople here being 24/7/365 monitored.\nThey have fulfillment centers from Amazon and can provide food to medicine, they have the entire military, all\ngovernment contracts and their own physicians. \n\n#malware #foundry #rip #palantir # twitter #paypalmafia  #quasi #government # workerscompensation #law_enforcement # #jeffreyreimer #sabey #tsarabrashearslivesinourhearts",
      "modified": "2025-08-08T06:00:40.325000",
      "created": "2025-07-09T07:18:09.062000",
      "tags": [
        "present jun",
        "united",
        "status",
        "present may",
        "present sep",
        "search",
        "date",
        "entries",
        "trojan",
        "name servers",
        "ransom",
        "twitter",
        "redacted for",
        "showing",
        "passive dns",
        "urls",
        "softlayer",
        "internet",
        "encrypt",
        "record value",
        "body",
        "service",
        "russia",
        "spain",
        "germany",
        "netherlands",
        "aaaa",
        "france",
        "virtool",
        "creation date",
        "expiration date",
        "servers",
        "hostname add",
        "pulse pulses",
        "files",
        "present aug",
        "ip address",
        "applenoc",
        "unknown ns",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "unknown aaaa",
        "secure server",
        "msie",
        "chrome",
        "moved",
        "title",
        "gmt content",
        "type",
        "pulse submit",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses otx",
        "pulses",
        "related tags",
        "google safe",
        "indicator role",
        "title added",
        "active related",
        "url https",
        "dynamicloader",
        "write c",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "html",
        "as15169",
        "write",
        "xport",
        "copy",
        "guard",
        "malware",
        "suspicious",
        "next",
        "extraction",
        "data upload",
        "failed",
        "extri data",
        "include review",
        "exclude",
        "sugges",
        "stop x",
        "s data",
        "extr data",
        "extraction data",
        "enter soudcetdi",
        "ad tevdag",
        "cadad ad",
        "draie",
        "extri include",
        "review",
        "done",
        "levelblue",
        "exclude sugges",
        "uny inuuue",
        "find s",
        "typ hos",
        "script urls",
        "canada unknown",
        "script domains",
        "a domains"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 181,
        "FileHash-SHA1": 154,
        "FileHash-SHA256": 1857,
        "domain": 1424,
        "email": 13,
        "hostname": 1304,
        "URL": 4168,
        "CVE": 1,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9106,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "255 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ro03.younglok.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ro03.younglok.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776688718.0847716
}